lkml.org 
[lkml]   [2017]   [Feb]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 192/306] mei: bus: fix received data size check in NFC fixup
    3.16.40-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alexander Usyskin <alexander.usyskin@intel.com>

    commit 582ab27a063a506ccb55fc48afcc325342a2deba upstream.

    NFC version reply size checked against only header size, not against
    full message size. That may lead potentially to uninitialized memory access
    in version data.

    That leads to warnings when version data is accessed:
    drivers/misc/mei/bus-fixup.c: warning: '*((void *)&ver+11)' may be used uninitialized in this function [-Wuninitialized]: => 212:2

    Reported in
    Build regressions/improvements in v4.9-rc3
    https://lkml.org/lkml/2016/10/30/57

    Fixes: 59fcd7c63abf (mei: nfc: Initial nfc implementation)
    Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.16:
    - Drop change in mei_phy.c
    - Adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    --- a/drivers/misc/mei/nfc.c
    +++ b/drivers/misc/mei/nfc.c
    @@ -292,7 +292,7 @@ static int mei_nfc_if_version(struct mei
    return -ENOMEM;

    bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length);
    - if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) {
    + if (bytes_recv < if_version_length) {
    dev_err(&dev->pdev->dev, "Could not read IF version\n");
    ret = -EIO;
    goto err;
    \
     
     \ /
      Last update: 2017-02-16 00:11    [W:4.055 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site